In any case, you'll need haskell-platform for your OS. Install it first, if you're not a haskeller. Then install timeplot using cabal.

If you're building with "--flags=gtk", you'll need gtk2hs. On Ubuntu, you can install it with:

sudo apt-get install libghc6-gtk-dev

If you're building without gtk, you'll just need cairo. It is also part of gtk2hs, but perhaps easier to build. Contact me (ekirpichov at gmail) if you have problems. You can also try reading gtk2hs installation guide.

Conceptually, the input for timeplot is a collection of several tracks corresponding to different concurrent processes occuring in the logs, or to different characteristics of a process.
There are 3 kinds of tracks:

Counter/Event tracks: Such a track represents a counter that may be bumped up and down: for example, a user login event bumps the user counter up and a logout event bumps the counter down. This may be also thought of as a binary event track: the event starts and ends at some time instants - for example, a process of periodical reloading of some data. Such a track may also have 'pulse' events that tell that at a time moment something happened with the track. For example, we might have a track for errors and pulse it every time a request happens. It is also possible to plot graphs over durations of events on these event tracks.

Numeric tracks: Such a track represents observations of a numeric value at certain time instants. Example: HTTP server response time, memory usage etc.

Physically, the input for timeplot consists of lines, each line speaking about a time instant, the times being sorted in ascended order.
Each line has a time field, an event type field and a track field.
There are 5 kinds of input lines:

The output of timeplot is a vertical stack of charts of the kinds specified below, with their time axes aligned horizontally so that one may observe the interaction of events in different tracks.

timeplot currently supports the following kinds of charts:

Event plots ('event')

A sample event plot.

Any of the plots below over event durations ('duration .....')

Line plots ('lines') and dot plots ('dots')

A sample line plot. Dot plot is like this, but without lines and with circles at data points.

Counter histograms ('hist N')

How many errors occured in a program in 15-minute intervals.

Absolute and relative frequency histograms ('count N' and 'freq N')

The distribution of request types along 15-minute intervals in a program where there are just 2 of them, presented in the form of absolute counts and relative frequencies, and in clustered and stacked fashion.

Quantile histograms ('quantile N q1,q2,..')

That same line plot, but now for each day the minimum, median and maximum (0%, 50% and 100% quantiles respectively) values are shown

Input format: lines of the following form:
1234 >A - at time 1234, during event A has begun
1234 <A - at time 1234, during event A has ended
1234 !B - at time 1234, pulse event B has occured
1234 @B COLOR - at time 1234, the status of B became such that it is appropriate to draw it with color COLOR :)
1234 =C VAL - at time 1234, parameter C had numeric value VAL (for example, HTTP response time)
1234 =D `EVENT - at time 1234, event EVENT occured in process D (for example, HTTP response code)
It is assumed that many events of the same kind may occur at once.
Diagram kinds:
'event' is for event diagrams: during events are drawn like --[===]--- , pulse events like --|--
'duration XXXX' - plot any kind of diagram over the *durations* of events on a track (delimited by > ... <)
for example 'duration quantile 300 0.25,0.5,0.75' will plot these quantiles of durations of the events.
This is useful where your log looks like 'Started processing' ... 'Finished processing': you can plot
processing durations without computing them yourself.
'duration[C] XXXX' - same as 'duration', but of a track's name we only take the part before character C.
For example, if you have processes named 'MACHINE-PID' (i.e. UNIT027-8532) say 'begin something' /
'end something' and you're interested in the properties of per-machine durations, use duration[-].
'hist N' is for histograms: a histogram is drawn with granularity of N time units, where
the bin corresponding to [t..t+N) has value 'what was the maximal number of active events
in that interval'.
'freq N [TYPE]' is for event frequency histograms: a histogram of type TYPE (stacked or
clustered, default clustered) is drawn for each time bin of size N, about the distribution
of various ` events
'count N [TYPE]' is for event frequency histograms: a histogram of type TYPE (stacked or
clustered, default clustered) is drawn for each time bin of size N, about the counts of
various ` events
'quantile N q1,q2,..' (example: quantile 100 0.25,0.5,0.75) - a bar chart of corresponding
quantiles in time bins of size N
'binf N v1,v2,..' (example: binf 100 1,2,5,10) - a bar chart of frequency of values falling
into bins min..v1, v1..v2, .., v2..max in time bins of size N
'binc N v1,v2,..' (example: binf 100 1,2,5,10) - a bar chart of counts of values falling
into bins min..v1, v1..v2, .., v2..max in time bins of size N
'lines' - a simple line plot of numeric values
'dots' - a simple dot plot of numeric values
'cumsum' - a simple line plot of the sum of the numeric values
'sum N' - a simple line plot of the sum of the numeric values in time bins of size N
N is measured in units or in seconds.

And we're interested in the influence that product data reloading (a very lengthy process that reads data from a big file into memory) has on response time and on cache hit rate. We also think that the influence on response time might be different for different pages.

Reloading product data seems to gradually take up memory and decrease efficiency of the cache

Cache efficiency changes only for product.php

Response time for product.php depends crucially on cache efficiency

Quantiles of response time for product.php change sharply, not smoothly, at certain thresholds of cache hit rate.

(remember that the data is made up, and probably does not fairly represent the typical behavior of a web application)

All in all, this analysis leads to a thought that the first thing to fix in this program is memory efficiency and duration of data reloading, since it has a great impact on overall program performance.

This is the output of timeplot on a log file from a pinger program. It depicts the distribution of response times and HTTP errors, the distribution of per-host wait times (to avoid DOS'ing a particular host, the per-host request rate is limited), pinging sessions start/end moments and their durations.